Policy-based networking is the management of a network so that various kinds of traffic—data, voice, and video—get the priority of availability and bandwidth needed to serve the network's users effectively. With the convergence of data, telephone, and video traffic in the same network, companies will be challenged to manage traffic so that one kind of service doesn't preempt another kind. Using policy statements, network administrators can specify which kinds of service to give priority at what times of day on what parts of their Internet protocol (IP)-based network. This kind of management is often known as Quality of Service (QoS) and is controlled using policy-based network software. Theoretically, a policy statement could be as natural as: “Provide the fastest forwarding for all voice traffic to Chicago between 9 am and 3 pm.”
In actuality, most policy-based networking software today requires a much more detailed and network-aware statement. Currently, the Internet Engineering Task Force (IETF) is working on a standard policy framework and related protocols. A typical policy-based network includes a network management console at which policies are entered, edited, or called from a policy repository. Also included is a server, referred to as the policy decision point (PDP), that retrieves policies from the policy repository and acts on the policies on behalf of policy enforcement points (PEPs). PEPs are typically the router, switches, and other network devices that enforce the policies, using an access control list, queue management algorithms, or the like. A policy repository is also often used, which is a directory server of policies that is based on the lightweight directory access protocol (LDAP).
QoS requests arriving at a PEP are authorized by a PDP using either a pull or a push model. In the push model, the PDP pushes a policy decision to the PEP before the QoS request arrives. Usually, there is more than one PEP in the network and hence the PDP needs to determine to which PEP a given policy request needs to be sent. Today, this determination is performed through manual provisioning, for example by assigning variably-sized IP subnets to individual PEPs and storing this information in a domain name server (DNS). However, this provisioned topology awareness is time-consuming, error prone, and works poorly when the topology changes, such as in cases of network renumbering or subnet relocation from one PEP to another.
The above describes policy-based networking in terms of QoS, however policy-based networking and the need for a PDP to discover a PEP applies more broadly. For example, installation of a content tap in a switch or router, or dynamic control of Network Address Translator (NAT) or Firewall pinholes for a particular session can be viewed as policy-based networking as well. The present invention described herein applies equally well to all of these.